Solved ntoskrnl.exe 0x0000001E BSOD

[justinbronze]

Specs:
- Windows 7 Home Premium x64
- Original and only OS ever on the system
- Came pre-installed
- The entire system is about 2 months old
- The install is 2 months old.
- No other security system besides Microsoft Security Essentials

I'm getting a BSOD caused by the ntoskrnl.exe driver. Can't find any solutions. Could you guys help?

STOP error code is 0x0000001E.

Everything you need in the ZIP file.

(Note: It's not called minidump.zip because I have more than just the minidump in the zip file. I also have a dxdiag and some html files in there. All thing in there are relevant and helpful though.)

 

[writhziden]

Loading Dump File [C:\Users\Mike\Downloads\BSODDmpFiles\justinbronze\Windows_NT6_BSOD_jcgriff2\122711-31044-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\users\mike\documents\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e8e670
Debug session time: Tue Dec 27 08:40:25.115 2011 (UTC - 7:00)
System Uptime: 0 days 0:02:33.644
Loading Kernel Symbols
...............................................................
................................................................
........................
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1E, {ffffffffc0000005, fffff8800287afb0, 0, 0}

Probably caused by : CLASSPNP.SYS ( CLASSPNP!ServiceTransferRequest+a8 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800287afb0, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: 0000000000000000, Parameter 1 of the exception

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
+3665613334393163
fffff880`0287afb0 d8be870280f8    fdivr   dword ptr [rsi-77FFD79h]

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef8100
 0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

BUGCHECK_STR:  0x1E_c0000005

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  svchost.exe

CURRENT_IRQL:  0

DEVICE_OBJECT: fffffa80055b8c50

EXCEPTION_RECORD:  fffff8800287bed8 -- (.exr 0xfffff8800287bed8)
ExceptionAddress: fffff880019ae198 (CLASSPNP!ServiceTransferRequest+0x00000000000000a8)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

TRAP_FRAME:  fffff8800287bf80 -- (.trap 0xfffff8800287bf80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffa8003cc275000 rbx=0000000000000000 rcx=0000000000000001
rdx=fffffa80055b88b0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880019ae198 rsp=fffff8800287c110 rbp=fffffa80055b88b0
 r8=fffffa800433c060  r9=0000000000000200 r10=fffffa800433c1b0
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
CLASSPNP!ServiceTransferRequest+0xa8:
fffff880`019ae198 448b502c        mov     r10d,dword ptr [rax+2Ch] ds:c0e0:fffa8003`cc27502c=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002d514fb to fffff80002cc5c40

STACK_TEXT:  
fffff880`0287aef8 fffff800`02d514fb : 00000000`0000001e ffffffff`c0000005 fffff880`0287afb0 00000000`00000000 : nt!KeBugCheckEx
fffff880`0287af00 fffff800`02d19bb4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KipFatalFilter+0x1b
fffff880`0287af40 fffff800`02cf1a7c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x83d
fffff880`0287af80 fffff800`02cf14fd : fffff800`02e08c24 fffff880`0287c3c0 00000000`00000000 fffff800`02c49000 : nt!_C_specific_handler+0x8c
fffff880`0287aff0 fffff800`02cf02d5 : fffff800`02e08c24 fffff880`0287b068 fffff880`0287bed8 fffff800`02c49000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0287b020 fffff800`02d01361 : fffff880`0287bed8 fffff880`0287b730 fffff880`00000000 fffffa80`055b8a58 : nt!RtlDispatchException+0x415
fffff880`0287b700 fffff800`02cc52c2 : fffff880`0287bed8 fffffa80`0433c1b0 fffff880`0287bf80 fffffa80`0433f8e0 : nt!KiDispatchException+0x135
fffff880`0287bda0 fffff800`02cc3bca : 00000000`00004000 fffff880`0287c0e8 fffffa80`00001000 fffffa80`03ebacfc : nt!KiExceptionDispatch+0xc2
fffff880`0287bf80 fffff880`019ae198 : fffffa80`04cad180 fffffa80`053aa4b0 fffffa80`053424d0 fffff880`0287c128 : nt!KiGeneralProtectionFault+0x10a
fffff880`0287c110 fffff880`019ae975 : fffffa80`0433c060 fffffa80`055b8a00 00000000`00000003 fffff880`00000001 : CLASSPNP!ServiceTransferRequest+0xa8
fffff880`0287c1b0 fffff880`00e010af : fffffa80`055b88b0 00000002`bfe1a200 fffffa80`055b8aa0 00000000`00000000 : CLASSPNP!ClassReadWrite+0xd5
fffff880`0287c200 fffff880`00e1618c : fffffa80`03e90e20 fffffa80`055b88b0 fffffa80`055b88b0 fffff8a0`002106b0 : partmgr!PmGlobalDispatch+0x9f
fffff880`0287c230 fffff880`0195e2bf : 00000002`bfe1a200 fffffa80`03e98b90 fffffa80`055b88b0 00000000`00000000 : volmgr!VmReadWrite+0x11c
fffff880`0287c270 fffff880`0195e53c : fffffa80`03e98b90 fffff880`0287c8e0 fffffa80`03c1a980 fffffa80`04347010 : fvevol!FveReadWrite+0x47
fffff880`0287c2b0 fffff880`0195e593 : 00000000`00000000 fffffa80`055b88b0 00000000`00000000 fffffa80`0566dfc0 : fvevol!FveFilterRundownReadWrite+0x1dc
fffff880`0287c310 fffff880`018b84a9 : fffffa80`055b8b78 fffffa80`055b88b0 fffffa80`04346190 fffffa80`055b88b0 : fvevol!FveFilterRundownWrite+0x2f
fffff880`0287c340 fffff880`0122539a : fffff880`0287c5b0 00000000`00006000 fffff880`0287c4d8 00000000`00000200 : volsnap! ?? ::FNODOBFM::`string'+0x19f8
fffff880`0287c390 fffff800`02cd2618 : fffff880`0287c560 fffff880`01223d06 fffffa80`053424d0 fffff8a0`0259f140 : Ntfs!NtfsStorageDriverCallout+0x16
fffff880`0287c3c0 fffff880`01224f09 : fffff880`01225384 00000000`00000200 00000000`00000200 00000002`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`0287c4a0 fffff880`012243d6 : fffffa80`03eb5a70 00000000`00000000 fffff8a0`0259f140 00001000`00000000 : Ntfs!NtfsMultipleAsync+0xa9
fffff880`0287c510 fffff880`012285f4 : fffffa80`053424d0 fffffa80`055b88b0 00000002`9d0d1826 fffff8a0`0259f010 : Ntfs!NtfsNonCachedIo+0x216
fffff880`0287c6e0 fffff880`012291a3 : fffffa80`053424d0 fffffa80`055b88b0 fffff880`0287c800 fffff880`00000200 : Ntfs!NtfsCommonWrite+0x2d91
fffff880`0287c890 fffff880`01098bcf : fffffa80`055b8c08 fffffa80`055b88b0 fffffa80`05a90c30 00000000`00000000 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`0287c950 fffff880`010976df : fffffa80`04348c40 00000000`00000001 fffffa80`04348c00 fffffa80`055b88b0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0287c9e0 fffff800`02fce21b : 00000000`00000001 fffffa80`054f2620 00000000`00000001 fffffa80`055b88b0 : fltmgr!FltpDispatch+0xcf
fffff880`0287ca40 fffff800`02fd8c83 : fffffa80`055b8c50 00000000`00000000 fffffa80`054f2620 fffff880`009e9180 : nt!IopSynchronousServiceTail+0xfb
fffff880`0287cab0 fffff800`02cc4ed3 : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
fffff880`0287cbb0 00000000`76ea139a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`00d7f7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76ea139a


STACK_COMMAND:  kb

FOLLOWUP_IP: 
CLASSPNP!ServiceTransferRequest+a8
fffff880`019ae198 448b502c        mov     r10d,dword ptr [rax+2Ch]

SYMBOL_STACK_INDEX:  9

SYMBOL_NAME:  CLASSPNP!ServiceTransferRequest+a8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: CLASSPNP

IMAGE_NAME:  CLASSPNP.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7929b

FAILURE_BUCKET_ID:  X64_0x1E_c0000005_CLASSPNP!ServiceTransferRequest+a8

BUCKET_ID:  X64_0x1E_c0000005_CLASSPNP!ServiceTransferRequest+a8

Followup: MachineOwner
---------

The problems were system related. To rule out system corruption, run http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html to check system files. You may have to run it up to three times to fix any errors.

 

[justinbronze]

Windows Resource Protection did not find any integrity violations.

 

[JMH]

FYI.
Bug Check 0x1E: KMODE_EXCEPTION_NOT_HANDLED

* This indicates that a kernel-mode program generated an exception which the error handler did not catch.

* The following actions might prevent an error like this from happening again:

> Download and install updates and device drivers for your computer from Windows Update.
> Scan your computer for computer viruses.
> Check your hard disk for errors.

http://www.sevenforums.com/tutorials/433-disk-check.html

> For good measure download the free version of Malwarebytes.

Update it immediately.
Run a full system scan.

Tell us the results at the end please.

Malwarebytes : Download free malware, virus and spyware tools to get your computer back in shape!

 

[justinbronze]

Im going to run the disk check now.

I already have the full paid for version of Malwarebytes, and I run scans all the time. But I'll scan again for good measure.

 

[JMH]

Good luck!

 

[justinbronze]

Neither Malwarebytes nor Chkdsk found anything.

 

[writhziden]

Since everything checks out, we will have to do a more thorough investigation to determine the cause of your blue screens. Run Driver verifier as follows:
1. Backup your system and user files
2. Create a system restore point
3. If you do not have a Windows 7 DVD, Create a system repair disc
4. Run Driver Verifier

If Windows cannot start in normal mode with driver verifier running, start in safe mode. If it cannot start in safe mode or normal mode, restore the system restore point using http://www.sevenforums.com/tutorials/700-system-restore.html OPTION TWO.

Thanks to zigzag3143 for contributing to the above steps.

You may need to run the driver checks in groups instead of all at once as running all at once often causes blue screens to occur without creating dmp files. Recommend running approximately 1/3 of the non-Microsoft drivers at a time and posting any blue screen dmp files that you get after each set.

 

[zigzag3143]

Just a thought in passing. The first parameter in the DMP file is a memory exception and upon further examination it was called by bitlocker.

JUST TO TEST, I would disable bitlocker.

 

[justinbronze]

I don't have bitlocker on my computer.

 

[zigzag3143]

I don't have bitlocker on my computer.

Ah but you do and it is loaded.

 

[writhziden]

I don't have bitlocker on my computer.

Ah but you do and it is loaded.

Isn't it loaded on all Windows 7 systems as part of security? I have it on my computer, but I do not actually have bitlocker as an option through control panel or if I open up my computer and view my hard drives. As Brink states in http://www.sevenforums.com/tutorial...cryption-windows-7-drive-turn-off-no-tpm.html, BitLocker is only available in the Windows 7 Ultimate and Enterprise editions.

 

[justinbronze]

Bitlocker is not included on the Home version, which I have. When I type bitlocker into the search bar in the start menu, nothing comes up. When I look in control panel, nothing.

Logically, I can only conclude I do not have Bitlocker Drive Encryption.


EDIT: I only have 20 non-Microsoft drivers, so I'll be running verifier on 6 now, and the next two runs on 7 at a time. I'll put an update if verifier shows anything.

 

[zigzag3143]

Bitlocker is not included on the Home version, which I have. When I type bitlocker into the search bar in the start menu, nothing comes up. When I look in control panel, nothing.

Logically, I can only conclude I do not have Bitlocker Drive Encryption.

If you insist.

 

[justinbronze]

Bitlocker is not included on the Home version, which I have. When I type bitlocker into the search bar in the start menu, nothing comes up. When I look in control panel, nothing.

Logically, I can only conclude I do not have Bitlocker Drive Encryption.

If you insist.

I have seen your pictures and have no doubt it's related to Bitlocker. But I assure you, nowhere on my computer do I have Bitlocker and if I somehow did, by some miracle off chance, I have no way of getting to it.

I remain confident I do not have it, however.

 

[writhziden]

Bitlocker is not included on the Home version, which I have. When I type bitlocker into the search bar in the start menu, nothing comes up. When I look in control panel, nothing.

Logically, I can only conclude I do not have Bitlocker Drive Encryption.


EDIT: I only have 20 non-Microsoft drivers, so I'll be running verifier on 6 now, and the next two runs on 7 at a time. I'll put an update if verifier shows anything.

You do have it, but my theory is that it runs in a more basic form on our systems (I also have Home Premium) as part of security. Obviously you cannot disable it, so we cannot fix your issue that way. Run through the Driver Verifier steps I outlined, and we will try to track down any other possible causes of your blue screen errors.

 

[zigzag3143]

I don't have bitlocker on my computer.

Ah but you do and it is loaded.

Isn't it loaded on all Windows 7 systems as part of security? I have it on my computer, but I do not actually have bitlocker as an option through control panel or if I open up my computer and view my hard drives. As Brink states in http://www.sevenforums.com/tutorial...cryption-windows-7-drive-turn-off-no-tpm.html, BitLocker is only available in the Windows 7 Ultimate and Enterprise editions.

Of course you are somewhat correct MIke. Im out of here.

 

[justinbronze]

Bitlocker is not included on the Home version, which I have. When I type bitlocker into the search bar in the start menu, nothing comes up. When I look in control panel, nothing.

Logically, I can only conclude I do not have Bitlocker Drive Encryption.


EDIT: I only have 20 non-Microsoft drivers, so I'll be running verifier on 6 now, and the next two runs on 7 at a time. I'll put an update if verifier shows anything.

You do have it, but my theory is that it runs in a more basic form on our systems (I also have Home Premium) as part of security. Obviously you cannot disable it, so we cannot fix your issue that way. Run through the Driver Verifier steps I outlined, and we will try to track down any other possible causes of your blue screen errors.

That makes sense, thanks. I was starting to worry about how I'd find and fix it. Let's see if Verifier picks up anything. (If it doesn't, what does that mean exactly?)

And thank you ZigZag, for all your help in my time of need.

 

[writhziden]

That makes sense, thanks. I was starting to worry about how I'd find and fix it. Let's see if Verifier picks up anything. (If it doesn't, what does that mean exactly?)

And thank you ZigZag, for all your help in my time of need.

If Verifier does not pick anything up within 48 hours, then your system should be clean. If you are having issues running normally, though, I would be surprised if Verifier didn't cause a blue screen with one of your sets of drivers to help pinpoint which is causing issues.

 

[justinbronze]

Nothing with the first 6. Now starting the next 7.